This is a note to let you know that I've just added the patch titled
gpiolib: remove the GPIO device from the list when it's unregistered
to the 6.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
gpiolib-remove-the-gpio-device-from-the-list-when-it.patch
and it can be found in the queue-6.7 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit f69f8332c435b5d2f7d3003513501168692e63b4
Author: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
Date: Tue Jan 2 16:59:47 2024 +0100
gpiolib: remove the GPIO device from the list when it's unregistered
[ Upstream commit 48e1b4d369cfe2729138a128afa6b8a55d093eaf ]
If we wait until the GPIO device's .release() callback gets invoked
before we remove it from the global device list, then we risk that
someone will look it up using gpio_device_find() between where we
dropped the last reference and before .release() is done taking a
reference again to an object that's being released.
The device must be removed when it's being unregistered - just like how
we remove it from the GPIO bus.
Fixes: ff2b13592299 ("gpio: make the gpiochip a real device")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
Reviewed-by: Linus Walleij <linus.walleij@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 3518481c433f..74bcdb50c931 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -650,9 +650,6 @@ static void gpiodev_release(struct device *dev)
{
struct gpio_device *gdev = to_gpio_device(dev);
- scoped_guard(mutex, &gpio_devices_lock)
- list_del(&gdev->list);
-
ida_free(&gpio_ida, gdev->id);
kfree_const(gdev->label);
kfree(gdev->descs);
@@ -1067,6 +1064,9 @@ void gpiochip_remove(struct gpio_chip *gc)
dev_crit(&gdev->dev,
"REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
+ scoped_guard(mutex, &gpio_devices_lock)
+ list_del(&gdev->list);
+
/*
* The gpiochip side puts its use of the device to rest here:
* if there are no userspace clients, the chardev and device will
